Fly.io CLI and Least-Privilege Token Setup

Overview

Separate interactive login from automation credentials. Current Fly.io guidance provides scoped deploy, organization, read-only, SSH, Machine-exec, and WireGuard token types; choose the smallest authority and lifespan that satisfies the workflow.

Prerequisites

• Named human or workload identity and business owner
• Target organization, app, commands, environment, and expiry requirement
• Approved installation source and secret storage location

Instructions

Step 1: Select the identity mode

Use browser login for a human workstation. For automation, map required actions to app deploy, organization deploy, read-only, SSH, Machine-exec, or WireGuard scope.

Step 2: Install from an official channel